>I can see that they don't want to make demands on a service they get for free, when HTTPS isn't even necessary for the use case you could imagine a situation

>I can see that they don't want to make demands on a service they get for free, when HTTPS isn't even necessary for the use case you could imagine a situation where https would be optional for APT mirrors. Then the package manager would have a config flag to use any mirror or only https-enabled mirrors (probably enabled by default). This would allow to use https without creating any demands to organizations that host those mirrors - if they can they would enable it, but it would not be required. The https-enabled hosts could also provide plain http for backwards compatibility.